Detecting and preventing bots and cheating in online gaming

ABSTRACT

Methods and devices are provided for detecting and/or preventing cheating in online gaming. Some implementations provide gaming information in formats that are difficult for a bot to interpret, but which are preferably easy for humans to interpret. Some implementations of the invention involve the tracking and analysis of players&#39; gaming activities. Some implementations of the invention provide a multi-tier approach to data analysis. Some analyses may be performed, for example, by a centralized computing device such as a server, whereas other analyses may be performed by a host device. In some implementations, “challenge and response” measures will be employed. Some implementations of the invention involve detection and prevention of collaboration between players.

FIELD OF THE INVENTION

The present disclosure relates to gaming devices, methods and networks.In particular, the invention relates to wagering games conducted via theInternet, which will sometimes be referred to herein as “online gaming”or the like. However, as described below, the invention is not limitedto wagering games.

BACKGROUND OF THE INVENTION

Although Internet wagering games are currently illegal in the UnitedStates, they are very popular in many parts of the world. A recent pollof United States citizens determined that approximately 67% believedthat the United States government should allow entities based in theUnited States to legally provide Internet wagering games.

One barrier to the further acceptance of online gaming by the UnitedStates government (and other governments) is the perception that onlinegaming very often involves cheating. Such cheating may take variousforms. For example, some players are known to use so-called “bots” (orsimilar software) for Internet wagering games. These bots can applyperfect or nearly perfect strategies during game play. Other types ofcheating involve unfair collaboration between players.

In some instances, the foregoing techniques have been combined toproduce an even greater advantage. Moreover, some online players usemultiple devices for cheating. For example, a player may use a firstpersonal computer (“PC”) for participation in online gaming via, e.g., agaming application and a restricted user account. A bot and remotecontrol software may be running on a second PC, whereby the games playedon the first PC are being controlled by the bot on the second PC. Inthis way, a human will appear to be participating in the online gamingsessions and could even interact with other players or provide otherhuman responses that would be difficult to automate.

It will probably be illegal to provide Internet wagering games in theUnited States and other jurisdictions until it can be proven to gamingregulators that the games can be provided in a fair and honest fashion.Accordingly, it would be very desirable to develop new methods fordetecting and preventing cheating in wagering games conducted via theInternet.

SUMMARY OF THE INVENTION

Methods and devices are provided for detecting and/or preventingcheating in online gaming. Some implementations provide gaminginformation in formats that are difficult for a bot to interpret, butwhich are preferably easy for humans to interpret. Some implementationsof the invention involve the tracking and analysis of players' gamingactivities.

Some implementations of the invention provide a multi-variable and/or amulti-tier approach to data analysis. A centralized computing devicesuch as a server may perform some analyses, for example, whereas a hostdevice may perform other analyses. In some implementations, “challengeand response” measures will be employed. Some implementations of theinvention involve detection and prevention of collaboration betweenplayers.

Some implementations of the invention provide a gaming method thatincludes these steps: gathering gaming data on a host device whileonline gaming software is executing on the host device; evaluating afirst component of the gaming data to detect first indicia of cheating,the first component of the gaming data comprising financial data; andinvoking cheating countermeasures when first indicia of cheating aredetected. The first indicia of cheating may, for example, comprise winfrequency indicia or win amount indicia. In some such implementations, acentral computing device performs the evaluating step, at least in part.However, this need not be the case; other devices, including but notlimited to host devices or other local devices, may perform at leastpart of such evaluations.

The cheating countermeasures may comprise evaluating a second componentof the gaming data for second indicia of cheating. For example, thecheating countermeasures comprise causing a central device to query aselected host device for second indicia of cheating. The second indiciaof cheating may indicate the use of a bot to control, at least in part,game play decisions. The second indicia of cheating may comprise atleast one of play consistency indicia, reaction time indicia or optimalplay indicia.

Alternative gaming methods are provided herein. One such method includesthese steps: gathering gaming data on a first plurality of host deviceswhile online gaming software is executing on the plurality of hostdevices; evaluating a first component of the gaming data on a centralcomputing device to detect first indicia of cheating, the firstcomponent of the gaming data comprising financial data; analyzing asecond component of the gaming data gathered by at least one of thefirst plurality of host devices to detect second indicia of cheating;and invoking cheating countermeasures when first indicia of cheating orsecond indicia of cheating are detected.

The analyzing step may, for example, be performed by a host device inresponse to a signal from the central computing device. The signal maybe sent by the central computing device in response to detecting firstindicia of cheating. The second indicia of cheating may be playconsistency indicia, reaction time indicia, collusion indicia and/oroptimal play indicia. When a bot is detected according to at least oneof the first indicia of cheating or the second indicia of cheating, thecheating countermeasures may involve preventing the bot fromparticipating in games involving human participants.

The gaming method may include the step of transmitting a signal from thecentral computing device to a second plurality of host devices inresponse to detecting first indicia of cheating. The analyzing step mayinvolve evaluating collusion indicia and may be performed, at least inpart, by the central computing device based on information received fromthe second plurality of host devices. The information may, for example,comprise results of an analysis performed by the second plurality ofhost devices. Accordingly, the analyzing step may be performed, at leastin part, by the second plurality of host devices.

The analyzing step may involve collusion detection. For example, theanalyzing step may involve determining lapse times during which aplayer's game play is worse than the player's normal level of game playand/or determining whether one or more other players consistently winduring a player's lapse times.

Other gaming methods of the invention involve the steps of providing anonline wagering game involving a plurality of host devices and at leastone game server, and presenting game data required for participation inthe online wagering game in a format that requires a human interface orthe use of pattern recognition methods.

For example, the game data may comprise playing card data and the formatpresentation may comprise varying an angle of rotation for a playingcard, varying positions of playing card symbols on the playing cards, avariable display of playing card hands. The variable display maycomprise providing playing card hands as a single image of fanned-outplaying cards. Alternatively, or additionally, the format presentationmay comprise playing card images displayed as playing card backs,wherein playing card symbols are temporarily shown only at turned upcorners of the playing card images.

The format presentation may comprise an entire screen of game playinformation, including player input areas, displayed as one image. Forexample, the player input areas may comprise buttons that are displayedin different areas of the image at different times.

Some game data required for participation in the online wagering gamemay be provided in the format of voice commands. The voice commands maybe provided as voices having a variety of regional accents. Wageringdata for participation in the online wagering game may be provided asimages of wager tokens, such as images of poker chips.

Still other gaming methods are provided herein. One such method includesthese steps: gathering game play data while players are using aplurality of host devices to play Internet wagering games; analyzing thegame play data to determine individual players' typical gaming stylesand times of deviation from the typical gaming styles; and comparingtimes of deviation from players' typical gaming styles to determineinstances of probable collusion between players. The method may alsoinclude the following steps: determining locations of at least some ofthe plurality of host devices; and determining whether at least some ofthe instances of probable collusion involve multiple host devices at onelocation.

The present invention provides hardware that is configured to performthe methods of the invention, as well as software and/or firmware tocontrol devices to perform these and other methods. These and otherfeatures of the present invention will be presented in more detail inthe following detailed description of the invention and the associatedfigures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a network that may be used to implement some aspectsof the invention.

FIGS. 2A through 2F illustrate displays that may be used to implementsome aspects of the invention.

FIGS. 3A-3C illustrate graphical user interfaces (“GUIs”) that may beused to implement some aspects of the invention.

FIG. 4 is a flow chart that outlines some methods of the invention.

FIG. 5 is a flow chart that outlines other methods of the invention.

FIG. 6 is a flow chart that outlines yet other methods of the invention.

FIG. 7 is a flow chart that outlines alternative methods of theinvention.

FIG. 8 illustrates a network device that may be configured according tosome aspects of the invention.

DETAILED DESCRIPTION OF THE INVENTION

In this application, numerous specific details are set forth in order toprovide a thorough understanding of the present invention. It will beobvious, however, to one skilled in the art, that the present inventionmay be practiced without some or all of these specific details. In otherinstances, well known process steps have not been described in detail inorder not to obscure the present invention.

The present invention provides novel methods and devices to detectand/or prevent cheating in online gaming, including but not limited togaming that involves wagering games. Moreover, although many exemplarymethods will be described in the context of online poker games, someaspects of the present invention are not so limited, but instead applygenerally to games conducted via the Internet.

A simplified depiction of one such network is shown in FIG. 1. It willbe appreciated that other types of networks involving different devices,more or fewer devices, etc., may be used to implement the presentinvention. For example, game provider 105 provides Internet wageringgames, but is not a gaming establishment (such as a casino or the like)that provides on-site wagering games. However, in alternativeimplementations, game provider 105 may be associated with such a gamingestablishment.

In this example, game provider 105 provides Internet wagering games viaone or more of servers 110, 115, 120 and 125. In some implementations,servers 110, 115, 120 and 125 may be configured for specialized tasks.For example, server 110 may be primarily configured to provide games,server 115 may be primarily configured to provideauthentication/identification functions, server 120 may be primarilyconfigured to provide cheating detection services and relatedcountermeasures, and server 125 may be primarily configured to provideaccounting and financial services.

However, tasks may be apportioned among devices in any convenientfashion. For instance, host device 125 may allow an operator to monitorthe activities of game provider 105 and of gaming participants, but mayalso be involved in some aspects of data analysis/cheating detection. Asdescribed in more detail below, players' host devices may also beinvolved in some aspects of data gathering and analysis.

Telephone 130 allows direct verbal communication between personnel ofgame provider 105 and others, including gaming participants. Storagedevices 137 allow storage of data, including but not limited toaccounting and financial data, game play data, player data, analyses,etc. In some implementations of the invention, storage is provided atanother location, e.g., via a storage network. Such storage may, forexample, provide data mirroring or other types of redundancy.Preferably, redundant blades, servers and/or other devices providefailover protection.

Firewall 135 is interposed between the devices of game provider 105 andInternet 111. Game provider 105 provides wagering games to players inlocations 140, 160 and 170, and to wireless device 180, via Internet111. In this example, location 140 includes PC 145 and PC 150, location160 includes laptop 165 and location 170 includes iBook™ 175. Wirelessdevice 180 is a personal digital assistant in this example.

Financial institution 185 is also connected to Internet 111, viafirewall 190. Financial institution 185 may be a bank, a credit union, acredit card company, or another such institution. Part of the onlinegaming process may involve the transfer of funds to and/or from networkdevices of financial institution 185. For example, game provider 105 mayalso provide account reconciliation services, periodic reports or gamingwins and losses, etc., in connection with financial institution 185.

It will be appreciated that games could be played via devices other thanthose illustrated in FIG. 1 and that other devices not shown in FIG. 1may be used within the scope of the invention. For example, some methodsand devices described in U.S. patent application Ser. No. 10/981,435,entitled “LOCATION AND USER IDENTIFICATION FOR ONLINE GAMING” and filedon Nov. 3, 2004, which is hereby incorporated by reference, mayadvantageously be used in connection with the present invention. Suchdevices include, but are not limited to, location detection devices andbiometric devices (such as retinal scanners, hand and/or fingerprintscanners, voice recognition devices and the like).

Moreover, it will be appreciated that one or more networks other thanInternet 111 may be used to implement various aspects of the invention,such as a satellite network, a wireless network, a metro opticaltransport, the PSTN, etc. Accordingly, a variety of protocols may beused for communication, such as Internet Protocol (“IP”), Fibre Channel(“FC”), FC over IP (“FCIP”), Internet SCSI (“iSCSI,” an IP-basedstandard for linking data storage devices over a network andtransferring data by carrying SCSI commands over IP networks), DenseWavelength Division Multiplexing (“DWDM,” an optical technology used toincrease bandwidth over existing fiber optic backbones), or CodeDivision Multiple Access (CDMA, a wireless cellular communicationtechnology).

Existing online gaming applications generally seek to convey as littleinformation as possible, for the sakes of speed and efficiency. Beforeplay begins, game software will have been downloaded and card imageswill have typically been cached on a player's PC for quick reference.Any reference to that symbol and card image (e.g., a command instructinga display device to “show the 2 of Hearts image”) is an indication to abot that “I have a 2 of Hearts.” A human player generally does not knowthat he or she has a 2 of Hearts until an image of the card is presentedon the screen.

Some aspects of the present invention provide methods and devices forpreventing cheating in online gaming, or at least for making cheatingmore difficult and less prevalent. For example, some implementations ofthe present invention provide gaming information in formats that aredifficult for a bot to interpret, but which preferably are easy forhumans to interpret.

In order to make the use of bots more difficult, some implementations ofthe invention present playing card and/or hand images in a manner thatis difficult for bots to interpret. Instead of using commands thatreference playing card images, a new card or hand image may bedownloaded when cards are “dealt.”

Some exemplary playing card images are illustrated in FIGS. 2A through2F. FIGS. 2A through 2C provide examples of card images 200, 210 and 215wherein card symbol 201 and suit symbol 205 are presented in differentformats and positions. In each case, the card image indicates an Ace ofHearts in a format that a person would readily understand, but which maybe challenging for a bot to interpret, even if pattern-recognitionsoftware were used.

Here, card symbol 201 of FIG. 2A has a different font from that of cardsymbol 201 indicated in FIG. 2B and is in a different portion of thecard. The stippled, hand-drawn outline of an “A” shown in FIG. 2C ismerely one example of how letters and numbers may be distorted in waysthat are difficult for pattern recognition software to interpretproperly.

In FIGS. 2A through 2C, suit symbol 205 has a different size and adifferent aspect ratio. FIG. 2B illustrates how positioning card symbol201 near suit symbol 205 can convey information that will be easilyunderstood by a person, but could be difficult for pattern recognitionsoftware to sort out. In this example, the overall shape of card symbol201 and suit symbol 205 could be interpreted as, e.g., a diamond shape.This effect is enhanced in FIG. 2B because suit symbol 205 is notsolidly filled.

In some implementations of the invention, the entire playing card (orhand of playing cards) may be displayed as if it were rotated and/ordistorted in some fashion. As illustrated in FIG. 2D, card images 220can be displayed as rotated playing cards. Some implementations of theinvention create a display of a card dealer who appears to flip cardstoward the players, but they land a little bit skewed. The cards may berotated as shown in card image 220 of FIG. 2D, or they may appear toland in other orientations. The card images may be perfectly orimperfectly aligned.

The apparent playing card orientations may change, e.g., randomly. Insome implementations, the apparent playing card orientations changewithin a predetermined range that is deemed to be tolerable to humanplayers (e.g., rotated up to 45 degrees from the vertical). Preferably,the angle of rotation is enough to be challenging for an imagerecognition program; accordingly, some such implementations have aminimum angle of skew (e.g., at least 15 degrees).

FIG. 2E illustrates card image 225 wherein a card corner is briefly“flipped up” to reveal card symbol 201 and suit symbol 205. Such methodswill be more readily integrated into particular games. For example,Texas Holdem involves an action of turning up a corner of a card, inorder to identify the card. Nonetheless, these methods could be used inother card games that do not traditionally involve flipping up a cardcorner quickly, in order to provide another method for presentingplaying cards in a manner that is difficult for a bot to recognize.

In some implementations, an entire hand of cards is downloaded as oneimage, e.g., as shown in FIG. 2F. Here, hand display 230 depicts a handof playing cards that are fanned out as a player might hold a hand ofcards. The spacing and angle of rotation can be varied. The position andtype of display for card symbol 201 and suit symbol 205 may be varied,as described above. Images of individual cards may be displayed at sometimes and images of card hands may be displayed in other times.

Displays 300, 350 and 380 of FIGS. 3A, 3B and 3C, respectively, provideadditional examples of displays that may be used to implement someaspects of the invention. Such GUIs can make it difficult for a bot toparticipate in an online card game, while providing a convenient userinterface for human players. Displays 300, 350 and 380 are examples ofGUIs that may be used to implement various types of online poker games.It will be appreciated that other controls, more or fewer controls orcards, etc., may be used in GUIs that are within the scope and spirit ofthe invention. For example, alternative implementations provideblackjack GUIs, GUIs for other poker games, etc.

FIG. 3A, for example, includes control portion 301 with individualcontrol buttons that a player may use to fold (button 310), ante (button315), hold (button 320), raise (button 325) and/or draw (button 330).FIG. 3A depicts individual card images 307 in card portion 305. In someimplementations of the invention, individual card images 307 can bechanged independently from the rest of display 300. Accordingly, display300 could be used to implement some aspects of the invention wherein anoverall configuration of a GUI persists when some elements change: inthis example, one or more cards of card portion 305 could be replaced,while maintaining the overall configuration of control portion 301. Suchchanges may occur when new cards are drawn, between hands, etc.

In alternative implementations of the invention, however, a new GUI maybe downloaded, for example, each time a new hand (or even a new card) isprovided to a player. In some such implementations of the invention, aGUI will be changed more frequently as a countermeasure in response to,e.g., a suspected bot. Such countermeasures will be described in moredetail below.

Display 350 of FIG. 3B provides features similar to those of FIG. 3A,including the depiction of individual playing card images. However,control portion 301 and card portion 305 are presented in differentparts of display 350, as compared to display 300. It will be appreciatedthat even if the same buttons are used in control portion 301 and thesame number of playing cards are displayed, many alternativearrangements of controls and playing cards may be used in similar GUIs.Accordingly, some implementations of the invention provide GUIs thathave few or no changes when there is no indication of bot use, butwherein the frequency and/or the magnitude of the change increases whenbot play is suspected.

For example, display 380 of FIG. 3C provides a modification of display350 that should not be overly disruptive to a player, yet should besignificantly more challenging for a bot to interpret. The buttons incontrol portion 301 have been shifted. Card portion 305 is presented asa single hand of fanned-out cards. In some such implementations, theplaying card images in card portion 305 may be individually replacedwhen a player draws cards, and in other implementations a new “hand ofcards” image is downloaded and presented in card portion 305 when aplayer draws cards.

It will be appreciated that the examples of displays shown and describedherein are merely illustrative of many ways in which displays may bepresented and/or altered within the scope of the invention. For example,in some implementations of the invention, the format, shape and/orposition of a card symbol and/or suit symbol, playing cards, controls ofa GUI, etc., may change over time (e.g., from hand to hand). Otherpositions, shapes, etc., may be used for card symbols and suit symbolswithin the scope of the invention. Moreover, images of chips or the likemay be used for wagering instead of numerical bets.

Some cheaters may use image/pattern recognition software in conjunctionwith a bot in attempts to work around some of the foregoing displaymethods. However, many cheaters will not be able to do this easily. Evenrelatively sophisticated cheaters would require a certain amount of timeto implement the required image recognition software.

As increasingly effective image recognition software is deployed, otherdisplay methods, cheating detection methods, etc. can be implemented inresponse. Such methods may be applied across the board or ascountermeasures to specific instances of suspected bot use.

Moreover, some pattern recognition software will be able to correctlyinterpret game information in displays (or other necessary gameinformation, such as that provided by audio prompts) only part of thetime. These inabilities will be characteristic of certain versions ofpattern recognition software and can be tracked and recognized. Certainversions of bots and/or pattern recognition software may be identifiedand categorized according to such idiosyncrasies.

Such identification and categorization is one example of moregeneralized methods that may be applied to track, determine and analyzecharacteristics of players and bots. An overview of some such methodswill now be described with reference to flow chart 400 of FIG. 4.

The methods shown and described herein, including but not limited tothose outlined in FIG. 4, are not necessarily practiced in the sequenceshown or described. Moreover, the methods shown and described herein mayhave more or fewer steps than are indicated herein. For example, it maybe necessary to provide gaming software (step 407) only at certaintimes, e.g., initially, when there are updates, etc. However, players'eligibility should be determined (step 405) not only during an initialregistration process, but also before each session of gaming.

In step 401, a request is received (e.g., by a device of game provider105) from a player for online gaming. In step 405, it is determinedwhether a player is eligible to participate in the online gaming. If awagering game is involved, the player's location will need to be one inwhich the type of wagering game is permitted. Moreover, the player'sidentity and age need to be determined, in order to ensure that theplayer is old enough to play wagering games.

The player's available credit, creditworthiness, etc., should also beevaluated. However, although the financial aspects of online gaming aremulti-faceted and highly important, they are not the main thrust of thisapplication and will not be elaborated upon herein. Known methods ofaddressing such needs may be applied when implementing the presentinvention.

Any type of personal identification methods and devices known in the artmay be used to identify a player. Data used in an initial registrationprocess are preferably stored for subsequent use. For example, theplayer may be asked to use biometric device such as retinal scanner, afingerprint reader, etc., and to transmit the data obtained from thebiometric device to a central location. The player may be asked to inputa confirmation number, swipe a card, and/or use a special dongle havingan encrypted password, a key, etc. The player may be asked to make anoral response during a telephone call to a telephone number associatedwith the player's location. The oral response may be analyzed, e.g.,according to known voice biometrics of a user obtained during aregistration process, to verify the user's identity. The user may alsobe prompted to make statements verifying his or her identity, age, amaximum amount available for wagering or other statements, which arepreferably recorded and stored.

In some implementations, if the user's location is fixed, the locationwill be determined in part by reference to a database of land telephonelines, modems, etc., and corresponding addresses. The location may beverified by reference to a location determined by other methods, e.g.,by use of a “traceroute” or similar program to determine the location ofan Internet service provider's network device that is near a user's hostdevice.

However, some players may use a mobile device, such as wireless device180 of FIG. 1, for gaming. Accordingly, a user's location may change,even during the course of a gaming session. Therefore, in someimplementations, a user's location is determined in other ways, e.g., byreference to positioning information provided by a cellular telephonenetwork. For example, if the user is called on a cellular telephone toverify his or her identity, it may be presumed that the user's locationcould change during the gaming session. The location is preferablychecked again during the gaming session (if one is established) in orderto ensure that the player is still within a jurisdiction that allowsonline gaming.

The device or devices that a player uses for online gaming arepreferably identified and logged. Some implementations of the inventionapply device fingerprinting techniques for device identification and/orverification. Some such fingerprinting techniques involve theexploitation of small deviations in processor clock skews. Relevanttechniques are discussed, for example, in Kohno, Tadayoshi, “RemotePhysical Device Fingerprinting” (IEEE Symposium on Security and Privacy[May 2005]), which is hereby incorporated by reference for all purposes.

After a player's eligibility is determined, gaming software is provided(step 407), e.g., by downloading the software from a server of gameprovider 105 to a player's host device in an uncontrolled environment.In step 410, it is determined whether enough players are currentlyavailable to play a requested type of game. If there are sufficientplayers available, online games will be provided to eligible players.

In step 420, players' gaming data are collected and analyzed. Someimplementations of the invention involve the tracking and analysis ofgaming data that includes, but is not limited to, the following:response time, win frequency, win amount, time spent playing, game playdecisions and wagering decisions. A player's responses and other gamingdata are preferably tracked over a period of time.

For example, some implementations compare a player's game play decisionswith a “perfect” game play strategy. A player's style of play may bedetermined and categorized, including but not limited to the percentageof the time a player makes optimal game play decisions, the length oftypical gaming sessions, typical wagering amounts, etc. A normalvariation in one or more such factors may be determined so that abnormalinstances of game play can be determined.

Accordingly, some implementations of the invention involve calculating aplayer's characteristic percentage of optimal decision-making, aplayer's characteristic range of deviation from this characteristicpercentage, a player's characteristic range of deviation from perfectgame play, or similar values. For example, a player may tend to makeoptimal decisions 90% of the time, on average, but the player may havemade optimal decisions during 95% of a particular gaming session, duringonly 87% of another gaming session, etc. A player's characteristic rangeof deviation may be, for example, a standard deviation, two standarddeviations, etc. A player may tend, for example, to deviate graduallyfrom perfect play as the player plays for an increasing length of time.If a player is suddenly playing at a level quite different from his orher historical range, this indicates that something is awry.

We would expect a bot's response time to be very consistent unless ithas been programmed otherwise. Humans are not that consistent. We wouldexpect a person's response time to vary within a predetermined range ofan average response time. Therefore, another metric that can be logged,stored and evaluated is a player's response time. A player's responsetime should vary, but players may tend to be faster or slower thanothers. A player's average response time and characteristic range ofdeviation from the average response time may be determined.

Some methods of the invention involve skill level classification, whichmay involve player classification and/or bot classification. Forexample, games (including but not limited to poker games) may beorganized by skill level. Players could be grouped with other players ata similar skill level. Players who play at a higher level and/or winmore would not be able to prey on beginners.

The data collection and analysis may be performed by a single device orby multiple devices. Some implementations of the invention provide amulti-tier approach to data collection and/or analysis, wherein datagathering and/or collection tasks are distributed among multipledevices. Certain types of data may be collected and/or analyzed at acentral location and other types of data may be collected and/oranalyzed at a host device, such as a player's host device. As describedin more detail below, some methods of the invention are performed, atleast in part, by software installed on a player's host device (e.g.,downloaded to a player's computer or the like).

In some implementations, game data are gathered by each host deviceduring each gaming session. At the end of each session, these data areassociated with a player and a host device, are time-stamped and aretransmitted to a central storage device. Preferably, the data arecompressed and hashed, for efficient data storage and to allowauthentication. A copy is preferably retained on the host device (or anassociated storage device).

In step 425, gaming data are evaluated for indicia of cheating. Manytypes of gaming data may be evaluated for indications of cheating withinthe scope of the invention. Preferably, data involving multiplevariables are analyzed in order to increase the likelihood of correctdeterminations. For example, consistently perfect or nearly-perfect gameplay suggests that a player is actually a bot (or is using a bot orsimilar software). However, if the player also has a consistently smallresponse time and can play for long time periods without making anerror, the player is even more likely to be a bot.

One way to detect a bot by using a multi-variable analysis is to detectplay that indicates a precise calculation of “pot odds” and related odds(such as implied odds and reverse implied odds) in a poker game. Theseodds which can be difficult for a human being to compute; it is veryunlikely that a person could quickly and consistently determine suchodds accurately.

Pot odds are a ratio of how much money is already in a pot compared tothe amount of money a player would have to put in the pot in order toremain in a hand. For example, if the pot is currently $150 and a playermust put in $15 to remain in the hand, the pot odds are 150 to 15 or 10to 1.

Ideally, the pot odds should be compared to the odds of winning a hand,which involves a determination of “implied odds” and “reverse impliedodds.” “Implied odds” are the odds that take into account future bets.“Reverse implied odds” and “redraws” involve the chance that a playerwill achieve a desired hand after a draw, but will still lose the hand.If the player thinks that the odds of achieving what the player believeswould be a winning hand are less than the pot odds (e.g., 1 in 5 in thisexample), the player should stay in the game.

Therefore, an accurate determination of pot odds involves both wageringdata and play level data. Moreover, if a player's response time isconsistent and small when complex pot odd calculations (or similarcalculations) are required, the player is probably a bot (or using abot).

An alternative indication of cheating could be indicated when anevaluation of a player's strategy indicates that the player is veryconsistently following a complex rule set, suggesting that a program/botis actually making the decisions. Such methods are particularlyeffective in “corner cases” wherein the application of a simple rule set(one that a normal human might use) would indicate one response, but amore sophisticated mathematical analysis would indicate anotherresponse.

For example, if the player is dealt a pair of face cards and three cardsto a royal flush, it is difficult to decide between going for the royalflush or just keeping the pair of face cards. Some players think the“safe” thing to do is hold the pair and draw three more cards for achance at three of a kind, four of a kind or a full house. However, amathematical analysis reveals that many poker games provide betterlong-term rewards for going for the royal flush. The actual corner casesthat exist will vary from one type of game to the next, so that even ifa player has memorized the best strategies for one type of game, he willunknowingly make some suboptimal choices in another very similar type ofgame. Therefore, some methods of the invention involve detecting suchcorner cases and determining whether a player is consistently makingresponses that only a computer program would be likely to make.

In step 430, it is determined whether indicia of cheating have beendetected. This determination may be made by a central computing device,e.g., one associated with game provider 105, and/or by a device inanother location, such as a player's host device. If no indicia ofcheating have been detected, play may continue as before (step 415).

However, if an indicium of cheating has been detected, cheatingcountermeasures are invoked (step 435). The term “cheatingcountermeasures” (and the like) is used herein to mean not only measurestaken when cheating is indicated, but also measures taken when cheatingor another irregularity is suspected. The severity of thecountermeasures should be commensurate not only with the degree and typeof cheating indicated, but also with the degree of certainty associatedwith the indication(s). For example, if there are preliminaryindications of bot use, a display may be used that is believed to bemore difficult for bots to interpret, the display type may be changedmore frequently, etc. On the other hand, if there is a very highprobability that cheating has occurred and is ongoing, a player may beprevented from further play, assessed a monetary penalty, etc. Certainusers and/or devices may be “blacklisted” and tracked. Information aboutblacklisted players and/or devices may be provided to other entities,possibly for a price.

The detection of a bot would not necessarily result only in some sort ofpenalty. For example, some implementations require bots to play in “botrooms” wherein player's bots can compete against one another. Forexample, game provider 105 could assess a penalty against a person whosebot is caught competing against humans, but could actually facilitatebot-against-bot play. A game provider could even enable bot-against-bottournaments. Some programmers have a great deal of pride in their workand may be very interested to determine how their bots would fare insuch a tournament.

Some implementations of the invention require responses to audio and/orvisual information in order to continue participating in a game. Forexample, a player may be required to respond correctly to a spokenquestion or command. A player may be prompted to perform an action toprove he or she is not a bot (“Wave at the camera,” “Stick out yourtongue,” “Raise your right pinky,” “Make a fist,” etc.). The actionscould be, e.g., recorded on a webcam and transmitted to a centrallocation for evaluation. The prompt is preferably in a form that wouldbe difficult for a bot to detect (audio, hashed writing, etc.).

In some implementations of the invention, such requirements arecountermeasures that are invoked when cheating is suspected. In suchimplementations, these types of “challenge and response” measures willbe used only when (or will be used more frequently when) indicia ofcheating have been detected and/or when a player is determined to beplaying abnormally.

For example, if a player is using another player's host device, the newplayer's play characteristics may be sufficiently different to allowdetection. An appropriate countermeasure might be to query the player,require identification, etc., to determine whether it is the same playeror is at least an authorized player. Accordingly, some methods of theinvention can help to verify that an under-age player is not using anolder player's ID, password and/or host device for online gaming.

In some alternative implementations, such requirements are implementedwhether or not cheating is suspected. New actions may be required on aregular basis. A player could be required to leave a webcam oncontinuously during play, with the understanding that the player couldbe randomly monitored at any time. However, such requirements may not bepopular with players.

Some required responses could be built into game play, to avoiddistracting a player or breaking a player's concentration. For example,instructions about game play could be given orally or in another formthat would be difficult for a bot to interpret (e.g., “You are notallowed to raise at this point”). A human player would be able torespond appropriately, but a bot would probably not respondappropriately. In some implementations, the accent used for voiceinstructions is changed from time to time, because such changes are verychallenging for voice recognition software.

Having an audio link between players could also help to root out bots.In some instances of game play, players will speak with various types ofaccents and possibly in various languages. If a player never speaks ornever responds appropriately, the player is likely to be a bot. Playerswould have a vested interest in making sure they are playing againstother humans. Players could report suspicious responses to a centralgame administrator. The administrator could provide various types ofcountermeasures, including any of the above detection/authenticationmethods, watching for other indications of a bot, etc. The administratorcould send a message to other players, such as “BOT DETECTED” or thelike. Such a notice would give other players a chance to leave the game.The administrator could terminate a cheater's activity.

Some cheating detection methods are more resource-intensive than others.Given the high volume of activity and the large number of playersinvolved in online gaming, selective application of cheating detectionmethods may be desirable. Therefore, some implementations of theinvention involve multi-tiered detection methods, wherein one level ofdata analysis may trigger another level of data analysis. In some suchimplementations, the analyses may be distributed over multiple devices.

Some such data collection and analyses may be more resource-intensiveand may, therefore, be performed (at least in part) by devices otherthan a centralized computing device. For example, data gathering and/oranalysis may be performed by software running on the host devices usedby players, e.g., for Internet wagering games. The software may beprovided, e.g., along with the software necessary for participating inInternet wagering games. Preferably, such software will need to beauthenticated prior to or during each gaming session by a digitalsignature, a “heartbeat,” etc.

Some such methods of the invention will now be described with referenceto FIGS. 5 and 6. Referring first to FIG. 5, method 500 begins after aplayer's request for gaming has been received and it has been determinedthat the player is eligible to play (in steps 401 and 405 or the like).In step 501, tracking software is provided along with gaming software.As used herein, the term “tracking software” and the like means softwarethat can at least track player gaming data, but which may also be ableto perform analysis and other higher-level functions.

The tracking software is preferably used at a high user permissionlevel. This is because an application running at a low level cannotdetect an application running at a higher level. However, an applicationrunning at a higher level can detect an application running at a lowerlevel. Therefore, tracking software running at a higher level should beable to detect remote control software from a second PC running a “bot”program.

Some implementations of the invention require authentication of trackingsoftware. For example, a server could check for the proper digitalsignature of tracking software. Some implementations involve a heartbeat(or the like) emitted by the tracking software and verified by a centralsystem (and/or vice versa) as a condition for continued play. Suchimplementations may have the “heartbeat” be irregular, change over time,change each time a session is initiated and/or when other predeterminedevents occur, etc., to make it harder to spoof.

If it is determined that enough players are available (step 510), onlinegames are provided to eligible players (step 515). In step 520, a firstcomponent of gaming data will be evaluated for first indicia ofcheating. For example, some such implementations analyze financialindicia (e.g., win frequency and/or amounts) to determine whether suchindicia exceed predetermined thresholds.

If first indicia of cheating are determined to exceed predeterminedthresholds (step 525), other types of analyses may be initiated orreported. In this example, first indicia of cheating are determined instep 525 and therefore a second component of gaming data is evaluatedfor second indicia of cheating. (Step 535.) For example, a determinationof greater-than-expected win frequency and/or win amounts in step 525may trigger a more detailed investigation of a player's response times,time spent playing, game play and wagering decisions, etc. (Step 530.)If second indicia of cheating are also determined (step 535), furthercheating countermeasures are invoked (step 540). The term “further” isused here because subsequent levels of analysis can be considered onetype of “countermeasure” as the term is used herein.

Some such implementations of the invention involve a two-tiereddetection method, wherein “light” statistics are tracked by a server orother central computing device (e.g., how much money players are making,how often they win, how long they are playing, etc.) and “heavy”statistics (e.g., percentage of the time that are players making thebest choice, response time, response time variation, etc.) are trackedby software running on a player's PC or other host device. Statistics onthe server are much harder to fake.

FIG. 6 outlines an instance of method 500 wherein the first component ofgaming data is analyzed by a centralized computing device such as aserver, by a host device associated with a gaming server, etc. (Step601.) Here, data tracked by a server or another such central computingdevice are used as threshold indicators for further investigation. Whenfirst indicia of cheating are detected (step 605), a second component ofgaming data is obtained (step 610) and evaluated (step 615).

In some such implementations, an administrator and/or a centralizedcomputing device will query another device in step 610 (e.g., a hostdevice or a storage device) for data and/or analytical results. Forexample, tracking software running on host devices may regularly collectrelevant data and may perform certain types of analyses only in responseto a prompt from a centralized computing device, an administrator, etc.Alternatively, the host device may perform relevant analyses on aroutine basis but will report results to centralized computing device,an administrator, etc., only in response to queries and/or only when ananalysis indicates that some form of cheating may be indicated:preferably, certain indicia of cheating (such as perfect game play) willbe automatically reported by a host device.

If second indicia of cheating are detected (step 620), further cheatingcountermeasures may be invoked. (Step 625.) If one or more players is nolonger able to play, it is possible that a particular game will need tobe suspended until more players are available. Therefore, the processreturns to step 510 to determine whether enough eligible players stilldesire to play the game.

However, if a player is cheating but still losing money, no action willbe taken according to some implementations of the invention.Alternatively, cheaters who are winning or losing approximately the sameamount as the average player may not immediately be prevented fromplaying, but instead may be flagged as cheaters, monitored and allowedto continue playing. These cheaters may be subjected to more rigorousscrutiny than average players, because their cheating methods are likelyto improve if they continue playing.

Moreover, the cheating of one player may involve intentionally helpinganother player. Some implementations of the invention involve detectionand prevention of unfair collaboration between players, which willsometimes be referred to herein as “collusion” or the like. Just as abot can be detected by perfect game play, collusion could be inferred bytimes of lapses/worse-than-normal game play that consistently benefitanother player or players. By flagging instances in which a player'sstyle of play gets worse and determining what other players arebenefiting during those times, it may be possible to detect collusionbetween players.

For instance, when one player has a strong hand and his “partner” has aweak hand, the partner could take actions to drive the betting up, sothat the partner could collect. The partner may be playing very well atother times, yet making blatant “mistakes” (e.g., in terms of wagering)when the partner has a strong hand. If the mistakes seem to defy thelogic of a rational player and consistently benefit another player orplayers, there is probably collusion.

Because most forms of collusion will not appear to benefit all playersinvolved, detecting collaboration may require analyses of more than oneplayer's gaming history. For example, in some implementations of theinvention, when one player is observed to be winning more than athreshold amount and/or more often than a threshold win frequency, notonly that player but other players involved in the games will beinvestigated. Various indicia that suggest collusion may beinvestigated, including but not limited to (1) the consistentinvolvement of certain players during times that a player is winning;(2) more than one player being in the same location during times thatthe player is winning; and (3) abnormally bad decisions on the part ofother players that consistently coincide with times that the player iswinning.

One collusion detection method is outlined by flow chart 700 of FIG. 7.In this example, both first and second indicia of cheating havepreviously been detected, so the method begins with step 535 of FIG. 5.However, various other scenarios could trigger an investigation ofcollusion. One such example was described above, wherein a playerappeared to be cheating but was nonetheless losing money. Such playerscould be flagged and used in a collusion analysis.

Next, the identities of a suspected colluder's recent opponents aredetermined (step 705). Players who have repeatedly been the suspectedcolluder's opponents are particularly suspect. Opponent gaming data arethen obtained. (Step 710.) In this example, opponent gaming data areobtained by querying the opponents' host devices, but the opponentgaming data may be obtained in other ways, e.g., by querying a storagedevice of a game provider wherein such data are routinely stored.

Opponent gaming data are then evaluated, in conjunction with gaming dataof the suspected colluder, for indicia of collusion. (Step 715.) In thisexample, it is determined whether more than one of the players has beenin the same location during times that the player is winning. It is alsodetermined whether abnormally bad decisions on the part of other playersconsistently coincide with times that another player is winning.

If collusion is detected, collusion countermeasures are invoked. (Step725.) These countermeasures may be substantially the same as somedescribed above, except that players with apparent losses may also bepenalized. Moreover, a further investigation into the identities ofother possible colluders may be triggered. For example, recent opponentsof all of the suspected colluder's opponents may be identified, gamedata regarding these players may be obtained and analyzed, etc. If nocollusion is detected, non-collusion countermeasures are invoked in thisexample, because first and second indicia of cheating had already beendetermined. Non-collusion countermeasures may include reassigningplayers to different games.

However, it is apparent that players don't have to be in the samelocation to be colluding with each other. Methods such as phone calls,instant messages, or even e-mail could also used effectively.Conversely, players in the same location are not necessarily colluding.Therefore, location alone is unlikely to be an accurate indicium ofcollusion.

FIG. 8 illustrates an example of a network device that may be configuredfor implementing some methods of the present invention. Network device860 includes a master central processing unit (CPU) 862, interfaces 868,and a bus 867 (e.g., a PCI bus). Generally, interfaces 868 include ports869 appropriate for communication with the appropriate media. In someembodiments, one or more of interfaces 868 includes at least oneindependent processor and, in some instances, volatile RAM. Theindependent processors may be, for example, ASICs or any otherappropriate processors. According to some such embodiments, theseindependent processors perform at least some of the functions of thelogic described herein. In some embodiments, one or more of interfaces868 control such communications-intensive tasks as encryption,decryption, compression, decompression, packetization, media control andmanagement. By providing separate processors for thecommunications-intensive tasks, interfaces 868 allow the mastermicroprocessor 862 efficiently to perform other functions such asrouting computations, network diagnostics, security functions, etc.

The interfaces 868 are typically provided as interface cards (sometimesreferred to as “linecards”). Generally, interfaces 868 control thesending and receiving of data packets over the network and sometimessupport other peripherals used with the network device 860. Among theinterfaces that may be provided are FC interfaces, Ethernet interfaces,frame relay interfaces, cable interfaces, DSL interfaces, token ringinterfaces, and the like. In addition, various very high-speedinterfaces may be provided, such as fast Ethernet interfaces, GigabitEthernet interfaces, ATM interfaces, HSSI interfaces, POS interfaces,FDDI interfaces, ASI interfaces, DHEI interfaces and the like.

When acting under the control of appropriate software or firmware, insome implementations of the invention CPU 862 may be responsible forimplementing specific functions associated with the functions of adesired network device. According to some embodiments, CPU 862accomplishes all these functions under the control of software includingan operating system and any appropriate applications software.

CPU 862 may include one or more processors 863 such as a processor fromthe Motorola family of microprocessors or the MIPS family ofmicroprocessors. In an alternative embodiment, processor 863 isspecially designed hardware for controlling the operations of networkdevice 860. In a specific embodiment, a memory 861 (such as non-volatileRAM and/or ROM) also forms part of CPU 862. However, there are manydifferent ways in which memory could be coupled to the system. Memoryblock 861 may be used for a variety of purposes such as, for example,caching and/or storing data, programming instructions, etc.

Regardless of the network device's configuration, it may employ one ormore memories or memory modules (such as, for example, memory block 865)configured to store data, program instructions for the general-purposenetwork operations and/or other information relating to thefunctionality of the techniques described herein. The programinstructions may control the operation of an operating system and/or oneor more applications, for example.

Because such information and program instructions may be employed toimplement the systems/methods described herein, the present inventionrelates to machine-readable media that include program instructions,state information, etc. for performing various operations describedherein. Examples of machine-readable media include, but are not limitedto, magnetic media such as hard disks, floppy disks, and magnetic tape;optical media such as CD-ROM disks; magneto-optical media; and hardwaredevices that are specially configured to store and perform programinstructions, such as read-only memory devices (ROM) and random accessmemory (RAM). The invention may also be embodied in a carrier wavetraveling over an appropriate medium such as airwaves, optical lines,electric lines, etc. Examples of program instructions include bothmachine code, such as produced by a compiler, and files containinghigher-level code that may be executed by the computer using aninterpreter.

Although the system shown in FIG. 8 illustrates one specific networkdevice of the present invention, it is by no means the only networkdevice architecture on which the present invention can be implemented.For example, an architecture having a single processor that handlescommunications as well as routing computations, etc. is often used.Further, other types of interfaces and media could also be used with thenetwork device. The communication path between interfaces may be busbased (as shown in FIG. 8) or switch fabric based (such as a cross-bar).

The above-described devices and materials will be familiar to those ofskill in the computer hardware and software arts. Although many of thecomponents and processes are described above in the singular forconvenience, it will be appreciated by one of skill in the art thatmultiple components and repeated processes can also be used to practicethe techniques of the present invention.

Although illustrative embodiments and applications of this invention areshown and described herein, many variations and modifications arepossible which remain within the concept, scope, and spirit of theinvention, and these variations would become clear to those of ordinaryskill in the art after perusal of this application. Accordingly, thepresent embodiments are to be considered as illustrative and notrestrictive, and the invention is not to be limited to the details givenherein, but may be modified within the scope and equivalents of theappended claims.

1. A gaming method, comprising: gathering gaming data on a host devicewhile online gaming software is executing on the host device; evaluatinga first component of the gaming data to detect first indicia ofcheating, the first component of the gaming data comprising financialdata; and invoking cheating countermeasures when first indicia ofcheating are detected.
 2. The gaming method of claim 1, wherein thefirst indicia of cheating comprise win frequency indicia or win amountindicia.
 3. The gaming method of claim 1, wherein the evaluating step isperformed by a central computing device.
 4. The gaming method of claim1, wherein the cheating countermeasures comprise evaluating a secondcomponent of the gaming data for second indicia of cheating.
 5. Thegaming method of claim 1, wherein the cheating countermeasures comprisecausing a central device to query a selected host device for secondindicia of cheating.
 6. The gaming method of claim 4, wherein the secondindicia of cheating indicate the use of a bot to control, at least inpart, game play decisions.
 7. The gaming method of claim 4, wherein thesecond indicia of cheating comprise at least one of play consistencyindicia, reaction time indicia or optimal play indicia.
 8. A gamingmethod, comprising: gathering gaming data on a first plurality of hostdevices while online gaming software is executing on the plurality ofhost devices; evaluating a first component of the gaming data on acentral computing device to detect first indicia of cheating, the firstcomponent of the gaming data comprising financial data; analyzing asecond component of the gaming data gathered by at least one of thefirst plurality of host devices to detect second indicia of cheating;and invoking cheating countermeasures when first indicia of cheating orsecond indicia of cheating are detected.
 9. The gaming method of claim8, wherein the analyzing step is performed by a host device in responseto a signal from the central computing device to the host device, thesignal being sent by the central computing device in response todetecting first indicia of cheating.
 10. The gaming method of claim 8,wherein the second indicia of cheating comprise at least one of playconsistency indicia, reaction time indicia, collusion indicia or optimalplay indicia.
 11. The gaming method of claim 8, further comprising thestep of transmitting a signal from the central computing device to asecond plurality of host devices in response to detecting first indiciaof cheating, wherein the analyzing step comprises evaluating collusionindicia and is performed, at least in part, by the central computingdevice based on information received from the second plurality of hostdevices.
 12. The gaming method of claim 8, wherein a bot is detectedaccording to at least one of the first indicia of cheating or the secondindicia of cheating and wherein the cheating countermeasures comprisepreventing the bot from participating in games involving humanparticipants.
 13. The gaming method of claim 11, wherein the analyzingstep is performed, at least in part, by the second plurality of hostdevices.
 14. The gaming method of claim 13, wherein the analyzing stepcomprises determining lapse times during which a player game play isworse than the player's normal level of game play.
 15. The gaming methodof claim 13, wherein the information received from the second pluralityof host devices comprises results of an analysis performed by the secondplurality of host devices.
 16. The gaming method of claim 14, whereinthe analyzing step further comprises determining whether one or moreother players consistently win during a player's lapse times.
 17. Agaming method, comprising: providing an online wagering game involving aplurality of host devices and at least one game server; and presentinggame data required for participation in the online wagering game in aformat that requires a human interface or the use of pattern recognitionmethods.
 18. The gaming method of claim 17, wherein the game datacomprise playing card data and wherein the format comprises varying anangle of rotation for a playing card.
 19. The gaming method of claim 17,wherein the game data comprise playing card data and wherein the formatcomprises varying positions of playing card symbols on the playingcards.
 20. The gaming method of claim 17, wherein the game datacomprises playing card data and wherein the format comprises a variabledisplay of playing card hands.
 21. The gaming method of claim 17,wherein the game data comprise playing card data and wherein the formatcomprises playing card images displayed as playing card backs, whereinplaying card symbols are temporarily shown only at turned up corners ofthe playing card images.
 22. The gaming method of claim 17, wherein theformat comprises an entire screen of game play information, includingplayer input areas, displayed as one image.
 23. The gaming method ofclaim 17, wherein some game data required for participation in theonline wagering game are provided in the format of voice commands. 24.The gaming method of claim 17, wherein wagering data for participationin the online wagering game are provided as images of wager tokens. 25.The gaming method of claim 20, wherein the variable display comprisesproviding playing card hands as a single image of fanned-out playingcards.
 26. The gaming method of claim 22, wherein the player input areascomprise buttons and wherein the format comprises displaying the buttonsin different areas of the image at different times.
 27. The gamingmethod of claim 23, wherein the voice commands are provided by voiceshaving a variety of regional accents.
 28. The gaming method of claim 24,wherein the images of wager tokens comprise images of poker chips.
 29. Agaming method, comprising: gathering game play data while players areusing a plurality of host devices to play Internet wagering games;analyzing the game play data to determine individual players' typicalgaming styles and times of deviation from the typical gaming styles; andcomparing times of deviation from players' typical gaming styles todetermine instances of probable collusion between players.
 30. Thegaming method of claim 29, further comprising: determining locations ofat least some of the plurality of host devices; and determining whetherat least some of the instances of probable collusion involve multiplehost devices at one location.
 31. A gaming network, comprising: meansfor providing online games of chance; means for gathering gaming data ona host device while online gaming software is executing on the hostdevice; means for evaluating a first component of the gaming data todetect first indicia of cheating, the first component of the gaming datacomprising financial data; and means for invoking cheatingcountermeasures when first indicia of cheating are detected.
 32. Thegaming network of claim 31, wherein the first indicia of cheatingcomprise win frequency indicia or win amount indicia.
 33. The gamingnetwork of claim 31, wherein the evaluating means comprises a centralcomputing device.
 34. The gaming network of claim 31, wherein thecheating countermeasures comprise evaluating a second component of thegaming data for second indicia of cheating.
 35. The gaming network ofclaim 31, wherein the cheating countermeasures comprise causing acentral device to query another device for second indicia of cheating.36. The gaming network of claim 4, wherein the second indicia ofcheating comprise at least one of play consistency indicia, reactiontime indicia or optimal play indicia.
 37. The gaming network of claim35, wherein another device comprises a selected host device or a storagedevice.
 38. A gaming network, comprising: means for gathering gamingdata on a first plurality of host devices while online gaming softwareis executing on the plurality of host devices; means for evaluating afirst component of the gaming data on a central computing device todetect first indicia of cheating, the first component of the gaming datacomprising financial data; means for analyzing a second component of thegaming data gathered by at least one of the first plurality of hostdevices to detect second indicia of cheating; and means for invokingcheating countermeasures when first indicia of cheating or secondindicia of cheating are detected.
 39. The gaming network of claim 38,wherein the analyzing step comprises a host device acting in response toa signal from the central computing device, the signal being sent by thecentral computing device in response to detecting first indicia ofcheating.
 40. The gaming network of claim 8, wherein the second indiciaof cheating comprise at least one of play consistency indicia, reactiontime indicia, collusion indicia or optimal play indicia.
 41. Softwarestored in a computer-readable medium, the software includinginstructions for controlling one or more devices in a network to performthe following steps: gathering gaming data on a host device while onlinegaming software is executing on the host device; evaluating a firstcomponent of the gaming data to detect first indicia of cheating, thefirst component of the gaming data comprising financial data; andinvoking cheating countermeasures when first indicia of cheating aredetected.
 42. The software of claim 41, wherein the first indicia ofcheating comprise win frequency indicia or win amount indicia.
 43. Thesoftware of claim 41, wherein the evaluating step is performed by acentral computing device.
 44. The software of claim 41, wherein thecheating countermeasures comprise evaluating a second component of thegaming data for second indicia of cheating.
 45. The software of claim41, wherein the cheating countermeasures comprise causing a centraldevice to query a selected host device for second indicia of cheating.